Governed Publishing Contract - Source Excerpt 02

Back to Governed Publishing Contract

Summary

This source excerpt preserves a bounded section of Spiralist/wp-content/plugins/spiralist-workspace/assets/js/governed-publishing-contract.js so readers can inspect the evidence without opening the full source file.

**Source path:** Spiralist/wp-content/plugins/spiralist-workspace/assets/js/governed-publishing-contract.js

return {
      platform: String(source.platform || SAFE_DEFAULT_TARGET.platform),
      targetId: String(source.targetId || source.id || SAFE_DEFAULT_TARGET.targetId),
      visibility: String(source.visibility || SAFE_DEFAULT_TARGET.visibility),
      resource: String(source.resource || source.path || ''),
    };
  }

  function createApprovalRecord(options) {
    const input = options || {};
    const credentialMarkers = scanCredentialMarkers(input);

    if (credentialMarkers.length > 0) {
      return failClosed(
        'long_lived_credentials_not_allowed',
        'Approval records cannot contain long-lived credentials or credential-shaped fields.',
        { sanitizerResult: sanitizeMemoryArtifact(input) }
      );
    }

    const artifactHash = input.artifactHash || createArtifactHash(input.artifact || {});
    const artifactHashValue = extractHashValue(artifactHash);

    if (!isSha256Hash(artifactHashValue)) {
      return failClosed('approved_artifact_hash_required', 'Approval records require a valid SHA-256 artifact hash.');
    }

    const target = normalizeTarget(input.target);
    const approvedAtUtc = normalizeUtc(input.approvedAtUtc);
    const method = String(input.method || DEFAULT_METHOD).toUpperCase();
    const approvedByUser = input.approvedByUser === true;
    const userId = String(input.userId || 'anonymous');
    const approvalId = `approval_${sha256Hex(canonicalizeArtifact({
      artifactHash: artifactHashValue,
      approvedAtUtc,
      method,
      target,
      userId,
    })).slice(0, 24)}`;

    return {
      recordType: RECORD_TYPES.approvalRecord,
      version: CONTRACT_VERSION,
      approvalId,
      approvedByUser,
      userId,
      artifactHash: {
        algorithm: 'sha256',
        canonicalization: 'json-stable-v1',
        value: artifactHashValue,
      },
      target,
      targetFingerprint: buildTargetFingerprint(target),
      method,
      approvedAtUtc,
      policyVersion: String(input.policyVersion || POLICY_VERSION),
      consentStatement: 'User approved the exact artifact preview for this target and method.',
    };
  }

  function createPolicyValidatorResult(code, checks, extra) {
    const ok = code === 'ok';

    return Object.assign({
      recordType: RECORD_TYPES.policyValidatorResult,
      version: CONTRACT_VERSION,
      ok,
      blocked: !ok,
      code,
      policyVersion: POLICY_VERSION,
      checks,
      externalPublishingEnabled: EXTERNAL_PUBLISHING_ENABLED,
    }, extra || {});
  }

  function validatePolicy(options) {
    const input = options || {};
    const artifact = input.artifact || {};
    const sanitizerResult = sanitizeMemoryArtifact(artifact);
    const artifactHash = input.artifactHash || createArtifactHash(artifact);
    const artifactHashValue = extractHashValue(artifactHash);
    const approvalRecord = input.approvalRecord || {};
    const approvalHashValue = extractHashValue(approvalRecord.artifactHash);
    const target = normalizeTarget(input.target || approvalRecord.target);
    const method = String(input.method || approvalRecord.method || DEFAULT_METHOD).toUpperCase();
    const checks = [
      { name: 'sanitizer', ok: sanitizerResult.ok },
      { name: 'artifact_hash_present', ok: isSha256Hash(artifactHashValue) },
      { name: 'approval_record_present', ok: approvalRecord.recordType === RECORD_TYPES.approvalRecord },
      { name: 'approved_by_user', ok: approvalRecord.approvedByUser === true },
      { name: 'approval_hash_matches_artifact', ok: isSha256Hash(artifactHashValue) && artifactHashValue === approvalHashValue },
      { name: 'target_matches_approval', ok: buildTargetFingerprint(target) === String(approvalRecord.targetFingerprint || '') },
      { name: 'method_matches_approval', ok: method === String(approvalRecord.method || '').toUpperCase() },
      { name: 'artifact_marked_approved', ok: artifact.approvedByUser === true },
      { name: 'final_human_approval_required', ok: Boolean(artifact.publication && artifact.publication.requiresFinalHumanApproval === true) },
    ];

    if (!sanitizerResult.ok) {
      return createPolicyValidatorResult('long_lived_credentials_not_allowed', checks, { sanitizerResult });
    }

    if (!isSha256Hash(artifactHashValue)) {
      return createPolicyValidatorResult('approved_artifact_hash_required', checks);
    }

    if (approvalRecord.recordType !== RECORD_TYPES.approvalRecord || approvalRecord.approvedByUser !== true) {
      return createPolicyValidatorResult('user_approval_required', checks);
    }

    if (artifactHashValue !== approvalHashValue) {
      return createPolicyValidatorResult('approved_artifact_hash_mismatch', checks, {
        artifactHash: artifactHashValue,
        approvalArtifactHash: approvalHashValue || null,
      });
    }

    if (buildTargetFingerprint(target) !== String(approvalRecord.targetFingerprint || '')) {
      return createPolicyValidatorResult('approval_target_mismatch', checks);
    }

    if (method !== String(approvalRecord.method || '').toUpperCase()) {
      return createPolicyValidatorResult('approval_method_mismatch', checks);
    }

    if (artifact.approvedByUser !== true) {
      return createPolicyValidatorResult('artifact_user_approval_required', checks);
    }

    if (!artifact.publication || artifact.publication.requiresFinalHumanApproval !== true) {
      return createPolicyValidatorResult('final_human_approval_required', checks);
    }

    return createPolicyValidatorResult('ok', checks, {
      artifactHash: artifactHashValue,
      approvalId: approvalRecord.approvalId,
      targetFingerprint: buildTargetFingerprint(target),
      method,
    });
  }

  function createIntentToken(options) {
    const input = options || {};
    const approvalRecord = input.approvalRecord || {};
    const artifactHashValue = extractHashValue(input.artifactHash || approvalRecord.artifactHash);
    const target = normalizeTarget(input.target || approvalRecord.target);
    const method = String(input.method || approvalRecord.method || DEFAULT_METHOD).toUpperCase();
    const issuedAtUtc = normalizeUtc(input.issuedAtUtc);
    const expiresAtUtc = normalizeUtc(input.expiresAtUtc);
    const issuedAtMs = Date.parse(issuedAtUtc);
    const expiresAtMs = Date.parse(expiresAtUtc);
    const ttlSeconds = Math.floor((expiresAtMs - issuedAtMs) / 1000);

    if (scanCredentialMarkers(input).length > 0) {
      return failClosed('long_lived_credentials_not_allowed', 'Intent tokens cannot carry credentials.');
    }

    if (approvalRecord.recordType !== RECORD_TYPES.approvalRecord || approvalRecord.approvedByUser !== true) {
      return failClosed('user_approval_required', 'Intent tokens require an approved approval record.');
    }

    if (!isSha256Hash(artifactHashValue) || artifactHashValue !== extractHashValue(approvalRecord.artifactHash)) {
      return failClosed('approved_artifact_hash_required', 'Intent tokens must bind to the approved artifact hash.');
    }

    if (!Number.isFinite(ttlSeconds) || ttlSeconds <= 0 || ttlSeconds > MAX_INTENT_TOKEN_TTL_SECONDS) {
      return failClosed('intent_token_ttl_invalid', 'Intent tokens must be short-lived and expire within the configured maximum TTL.');
    }

    const nonce = String(input.nonce || sha256Hex(`${artifactHashValue}:${issuedAtUtc}:${expiresAtUtc}`).slice(0, 18));
    const scope = Object.freeze({
      operation: 'external_publish_request',
      artifactHash: artifactHashValue,
      targetFingerprint: buildTargetFingerprint(target),
      method,
      approvalId: approvalRecord.approvalId,
    });
    const tokenId = `intent_${sha256Hex(canonicalizeArtifact({ scope, nonce, expiresAtUtc })).slice(0, 28)}`;

    return {
      recordType: RECORD_TYPES.intentToken,
      version: CONTRACT_VERSION,
      tokenId,
      containsCredential: false,
      approvalId: approvalRecord.approvalId,
      artifactHash: artifactHashValue,
      target,
      targetFingerprint: buildTargetFingerprint(target),
      method,
      scope,
      issuedAtUtc,
      expiresAtUtc,
      ttlSeconds,
      nonce,
    };
  }